What is the DmaSecurity AllowedBus Extension Windows Driver?

The DmaSecurity AllowedBus Extension (sometimes referred to as DmaSecurity.sys) is part of a security feature in Windows, designed to mitigate Direct Memory Access (DMA) attacks.

DMA is a process where hardware devices (like network cards, GPUs, storage devices, etc.) can directly access system memory, bypassing the CPU and operating system. While this can be beneficial for performance, it also introduces a potential security risk. Attackers who gain physical access to the machine or certain privileges could exploit DMA-capable devices to access sensitive data in memory, even if the operating system is running securely.

To mitigate such risks, Windows introduced security features that limit which devices are allowed to perform DMA operations, especially for devices connected via PCI Express (PCIe) slots. The DmaSecurity AllowedBus Extension is a driver or component that works with these security features to enforce policies on which buses and devices are permitted to perform DMA operations.

In short:

• The DmaSecurity AllowedBus Extension helps control and restrict DMA access to protect the system from potential DMA-based attacks.